CVE-2026-16489

Deferred Deferred - Pending Action

Command Injection in jsforce Library

Publication date: 2026-07-22

Last updated on: 2026-07-23

Assigner: VulDB

Description

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16489

EUVD

EUVD-2026-47593

Affected Vendors & Products

Vendor	Product	Version / Range
jsforce	jsforce	to 3.10.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in the jsforce library up to version 3.10.16. It affects the _execCommand function in lib/registry/sfdx.js when the SFDX connection registry is enabled. The issue occurs because user-controlled connection names are concatenated into shell commands without proper escaping. An attacker can inject malicious commands via the -c or --connection CLI option, which are then executed on the local system.

Detection Guidance

Check if jsforce version 3.10.16 or earlier is installed by running: npm list jsforce. Verify if the JSFORCE_CONNECTION_REGISTRY environment variable is set to 'sfdx'. Inspect command execution logs for suspicious patterns like semicolons or other shell metacharacters in connection names.

Impact Analysis

An attacker could execute arbitrary commands on your system if they can provide a malicious connection name. This could lead to unauthorized file creation, data exfiltration, or system compromise. The attack requires local access but does not need valid Salesforce credentials. The exploit is publicly available, increasing the risk of misuse.

Compliance Impact

This vulnerability may violate compliance requirements that mandate secure handling of sensitive data and system access controls. For GDPR, it could lead to unauthorized data processing or access. For HIPAA, it might expose protected health information if commands are executed in a healthcare environment. The use of insecure authentication methods like SOAP also conflicts with modern security standards.

Mitigation Strategies

Upgrade jsforce to a version beyond 3.10.16 if available. Avoid using the -c or --connection CLI options with user-controlled input. Disable the SFDX connection registry if not required. Use safer APIs like child_process.execFile instead of child_process.exec.

Hi! I’m here to help you understand CVE-2026-16489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70